{"id":85736,"date":"2018-02-07T19:29:42","date_gmt":"2018-02-07T13:59:42","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=85736"},"modified":"2018-02-08T11:35:01","modified_gmt":"2018-02-08T06:05:01","slug":"analysis-ms-office-document-exploiting-zero-day-flash-player-vulnerability-cve-2018-4878","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/analysis-ms-office-document-exploiting-zero-day-flash-player-vulnerability-cve-2018-4878\/","title":{"rendered":"An analysis of an MS office document exploiting a zero-day flash player vulnerability (CVE-2018-4878)"},"content":{"rendered":"

Important update!<\/strong>
\nAdobe Systems released a critical security update<\/a> on 6.02.2017 to fix the vulnerability discussed in this post. We recommend you to apply the update immediately.<\/p>\n

Summary of the vulnerability<\/strong><\/p>\n

CVE-2018-4878 is a use-after-free vulnerability present in Adobe Flash Player 28.0.0.137 and its earlier versions are being exploited in the wild. A successful exploitation of this vulnerability could allow attackers to take control of the affected system. Attackers use a MS Office document which is distributed via a crafted email attachment (content embedded malformed Flash ActiveX object) to exploit this vulnerability.<\/p>\n

Quick Heal had earlier published an advisory<\/a> on this vulnerability.<\/p>\n

Quick Heal analysis<\/strong><\/p>\n

Quick Heal Security Labs came across a malicious Excel document that uses this zero-day vulnerability.<\/p>\n

The following is an analysis of the exploit sample.<\/p>\n

Components of the XLS<\/strong>X document<\/strong><\/p>\n

\"\"
Figure 1<\/figcaption><\/figure>\n

Figure 2 displays the content of the decoy document (in Korean).<\/strong><\/p>\n

\"\"
Figure 2<\/figcaption><\/figure>\n

As shown in figure 2, the content of the decoy document is related to \u2018cosmetic products\u2019 along with their price.<\/p>\n

As shown in figure 1, the malicious document contains an embedded Flash Player File (SWF) which in turn contains another encrypted SWF file, highlighted in figure 3 below.<\/p>\n

\"\"
Figure 3<\/figcaption><\/figure>\n

The following ActionScript snippet is used to decrypt the embedded SWF file.<\/p>\n

\"\"
Figure 4<\/figcaption><\/figure>\n

Upon opening the document, EXCEL.EXE loads a vulnerable version of Flash Player ActiveX (Flash32_XX_X_X_XXX.ocx) which is used to execute the embedded SWF file.<\/p>\n

\"\"
Figure 5<\/figcaption><\/figure>\n

Unfortunately, at the time of our analysis, the C&C server did not respond and the attack could not proceed further for us to analyze it.<\/p>\n

Details of the HTTP request sent by the exploit.<\/p>\n

\"\"
Figure 6<\/figcaption><\/figure>\n

Definitions of the highlighted sections in figure 6.<\/strong><\/p>\n

ID:<\/strong> Unique Identifier<\/p>\n

FP_VS:<\/strong> Flash Player version installed on the victim system<\/p>\n

OS_VS: <\/strong>installed on the Operating System version of victim system<\/p>\n

Indicators of compromise<\/strong><\/p>\n

    \n
  1. 5F97C5EA28C0401ABC093069A50AA1F8<\/li>\n
  2. www[.]dylboiler[.]co[.]kr<\/li>\n<\/ol>\n

    What to do?<\/strong><\/p>\n

      \n
    1. Update your Flash Player. Adobe has released the security update<\/a> to fix the discussed vulnerability<\/li>\n
    2. Update your antivirus<\/li>\n
    3. Enable Protected Mode for MS Office applications<\/li>\n
    4. Until you apply the fix, block Flash Player ActiveX for MS Office applications temporarily. Click here<\/a> to know how to do this<\/li>\n<\/ol>\n

      Conclusion<\/strong>
      \nThe attacker has encrypted a Flash object to make the analysis complex and difficult. The exploit retrieves the decryption key from the C&C Server which is currently inactive.<\/p>\n

      We are actively looking for other variants of this exploit for a detailed analysis.<\/p>\n

       <\/p>\n

      Subject Matter Experts<\/strong><\/p>\n

      Nitten Dhamanay, Siraj Attar | Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"

      Important update! Adobe Systems released a critical security update on 6.02.2017 to fix the vulnerability discussed in this post. We recommend you to apply the update immediately. Summary of the vulnerability CVE-2018-4878 is a use-after-free vulnerability present in Adobe Flash Player 28.0.0.137 and its earlier versions are being exploited in the wild. A successful exploitation […]<\/p>\n","protected":false},"author":29,"featured_media":85743,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[70,1395],"tags":[1576,1224,718],"class_list":["post-85736","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-adobe","category-vulnerability","tag-cve-2018-4878","tag-flash-player","tag-zero-day"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85736"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=85736"}],"version-history":[{"count":4,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85736\/revisions"}],"predecessor-version":[{"id":85753,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/85736\/revisions\/85753"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/85743"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=85736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=85736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=85736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}